Openstack Horizon vulnerabilities

• openstack horizon, the opennms group meridian +1 more OpenNMS denial of service via XML entity expansion CVE-2026-111252 6.5 MediumOctober 15, 2026
• openstack horizon, the opennms group meridian +1 more OpenNMS REST authorization bypass via non-canonical HTTP method CVE-2026-111235 9.1 CriticalOctober 15, 2026
• openstack horizon, the opennms group meridian +1 more OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) CVE-2026-89089 6.5 MediumSeptember 10, 2026
• openstack horizon, the opennms group meridian +1 more OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host CVE-2026-19596 5.9 MediumSeptember 10, 2026
• openstack horizon OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes CVE-2026-89054 8.2 HighSeptember 10, 2026
• openstack horizon, the opennms group meridian +1 more OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only CVE-2026-19182 4.3 MediumAugust 13, 2026
• openstack horizon, the opennms group meridian +1 more OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes CVE-2026-19135 5.4 MediumAugust 13, 2026
• openstack horizon OpenStack Horizon RC file generation does not escape special characters in project names CVE-2026-55748 Fix available 6.0 MediumJune 17, 2026
• openstack horizon OpenStack Horizon has Incorrect Behavior Order CVE-2026-43002 Fix available 5.3 MediumMay 5, 2026
• ancorathemes horizon WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerability CVE-2026-22420 8.1 HighMarch 5, 2026
• openstack horizon, the opennms group meridian +1 more SQLi in OpenNMS Horizon and Meridian CVE-2025-53122 6.9 MediumJune 26, 2025
• openstack horizon, the opennms group meridian +1 more Stored XSS in multiple 33.0.8files in opennms/opennms CVE-2025-53121 6.9 MediumJune 26, 2025
• opennms horizon, meridian +1 more Cross-site scripting in bootstrap.jsp CVE-2023-40314 Fix available 5.8 MediumNovember 16, 2023
• opennms horizon, meridian +1 more Authenticated XXE Injection Via The File Editor CVE-2023-40612 5.3 MediumAugust 23, 2023
• openstack horizon Horizon Web Dashboard Open Redirect vulnerability CVE-2022-45582 Fix available 6.1 MediumAugust 22, 2023
• opennms horizon, meridian +1 more ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN CVE-2023-40315 Public exploitFix available 5.3 MediumAugust 17, 2023
• opennms horizon, meridian +1 more Disable BeanShell Interpreter Remote Server Mode CVE-2023-40313 Fix available 7.1 HighAugust 17, 2023
• opennms horizon, meridian +1 more Reflected XSS in multiple JSP files in opennms/opennms CVE-2023-40312 Fix available 6.7 MediumAugust 14, 2023
• opennms horizon, meridian +1 more Stored XSS in multiple JSP files in opennms/opennms CVE-2023-40311 Fix available 6.7 MediumAugust 14, 2023
• opennms horizon, meridian +1 more ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users CVE-2023-0872 Public exploitFix available 8.2 HighAugust 14, 2023
• opennms horizon, meridian +1 more An XML External Entity injection vulnerability CVE-2023-0871 Fix available 5.4 MediumAugust 11, 2023
• opennms horizon, meridian +1 more Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) CVE-2023-0870 Fix available 8.1 HighMarch 22, 2023
• opennms horizon, meridian +1 more Plaintext Password Present in the Web logs CVE-2023-0815 Fix available 6.8 MediumFebruary 23, 2023
• opennms horizon, meridian +1 more Multiple stored and reflected Cross-site Scripting in webapp CVE-2023-0867 Fix available 6.7 MediumFebruary 23, 2023
• opennms horizon, meridian +1 more Stealing Cookies using Reflected XSS via graph results CVE-2023-0868 Fix available 6.7 MediumFebruary 23, 2023
• opennms horizon, meridian +1 more Cross-site scripting in outage/list.htm CVE-2023-0869 5.8 MediumFebruary 23, 2023
• opennms horizon, meridian +1 more Unauthenticated, stored XSS in display of alarm reduction-key CVE-2023-0846 Fix available 6.7 MediumFebruary 22, 2023
• openstack horizon, debian linux +1 more OpenStack Horizon Open redirect in workflow forms CVE-2020-29565 Fix available 6.1 MediumDecember 4, 2020
• openstack horizon, python-django-horizon, redhat openstack +2 more +4 more The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS... CVE-2012-5474 Fix available 5.5 MediumDecember 30, 2019
• debian linux, openstack horizon, openstack-dashboard +2 more Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum... CVE-2012-5476 5.5 MediumDecember 30, 2019
• openstack horizon OpenStack Horizon Cross-site Scripting (XSS) CVE-2017-7400 Fix available 4.8 MediumApril 3, 2017
• openstack horizon, redhat openstack, debian linux +2 more OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability CVE-2016-4428 Fix available 5.4 MediumJune 18, 2016
• openstack horizon, debian linux, oracle solaris +2 more OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability CVE-2015-3219 Fix available 4.3 MediumAugust 20, 2015
• openstack horizon, oracle solaris +1 more Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0... CVE-2015-3988 Fix available 3.5 LowMay 19, 2015
• openstack horizon Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon)... CVE-2014-8578 Fix available 3.5 LowOctober 31, 2014
• openstack horizon, fedoraproject fedora, opensuse +1 more +3 more OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly... CVE-2014-8124 Fix available 5.0 MediumAugust 28, 2014
• openstack horizon, opensuse +1 more OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface CVE-2014-3594 Fix available 3.5 LowAugust 19, 2014
• openstack horizon, opensuse +1 more Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard... CVE-2014-3475 Fix available 3.5 LowJuly 9, 2014
• openstack horizon, opensuse +1 more OpenStack Horizon Cross-site scripting (XSS) vulnerability CVE-2014-3474 Fix available 3.5 LowJuly 9, 2014
• openstack horizon, opensuse +1 more Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name CVE-2014-3473 Fix available 4.3 MediumJuly 9, 2014
• openstack horizon The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current... CVE-2013-4471 Fix available 5.5 MediumMay 14, 2014
• openstack horizon, opensuse +1 more OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting CVE-2014-0157 Fix available 4.3 MediumApril 15, 2014
• openstack horizon, canonical ubuntu linux, opensuse +2 more Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and... CVE-2013-6858 Fix available 4.3 MediumNovember 23, 2013
• openstack essex, horizon +1 more OpenStack Keystone Allows Remote User Account Creation CVE-2012-3542 Fix available 4.3 MediumSeptember 5, 2012
• openstack horizon Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1... CVE-2012-3540 Fix available 5.8 MediumSeptember 5, 2012
• openstack essex, keystone, horizon +2 more OpenStack Keystone token expiration issues CVE-2012-3426 Fix available 4.9 MediumJuly 31, 2012
• openstack horizon OpenStack Horizon Session Fixation CVE-2012-2144 Fix available 6.8 MediumJune 5, 2012
• openstack horizon OpenStack Horizon Cross-site scripting (XSS) vulnerability CVE-2012-2094 Fix available 4.3 MediumJune 5, 2012